MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5
SHA3-384 hash: f79cd32b7ec965e7bb47d97c3f67dc1554cd09f68eadb317b1a8af8481cbbefcdd2919f0b1544bdcaeb0c32838bb25ec
SHA1 hash: 95878c9ae830da49858b4a559a60c02558e48ea4
MD5 hash: f05d149e9ff22e60d9e2e0f3e6626be1
humanhash: michigan-nitrogen-moon-oranges
File name:8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5
Download: download sample
Signature Dridex
Create hunting rule
File size:827'392 bytes
First seen:2020-11-14 18:18:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 96927a99699f680c7045d444b5e2e2ca (13 x Dridex)
ssdeep 24576:DXUxGSHd8cik3CJr0zuISZVKnigKdNCXl:DJCdYE4wunuh4
Threatray 14 similar samples on MalwareBazaar
TLSH 3605D07482FDC315E1AB95F5F9E10CA00525F4268E369ACF2229812A547A6F53CF4B3F
Reporter seifreed
Tags:Dridex

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Bankerx-9787378-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for the window
Creating a window
Changing a file
Forced system process termination
DNS request
Sending a custom TCP request
Forced shutdown of a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/535506
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 316852 Sample: Xe2iOoKw4y Startdate: 15/11/2020 Architecture: WINDOWS Score: 68 31 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 Machine Learning detection for sample 2->35 37 2 other signatures 2->37 8 loaddll32.exe 1 2->8         started        10 explorer.exe 1 106 2->10         started        12 rundll32.exe 2->12         started        14 2 other processes 2->14 process3 process4 16 cmd.exe 1 8->16         started        18 regsvr32.exe 8->18         started        process5 20 iexplore.exe 1 74 16->20         started        process6 22 iexplore.exe 155 20->22         started        dnsIp7 25 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49754, 49755 YAHOO-DEBDE United Kingdom 22->25 27 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49756, 49757 FASTLYUS United States 22->27 29 9 other IPs or domains 22->29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5/
Threat name:
Win32.Trojan.Drixed
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:21:02 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rlgjuxsx7ysino5gxiifafatpwnxkkeuxrzsmketzrjc4cft7pcq._file
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
11831f3b2400978816bc852ed847ecdc7d4ce922abe3d9fb1ad554376ca838f5
Dridex
39f723dc9ee8a4cc2380dec93a8707b7671b146b5c2f3aa9abf52f6b72e89dff
Dridex
4f05ac6686f1403fded7c0fd61d9812b0a73c55386dd8e9dd60422f33b4578a1
Dridex
5b7295dd730079596569be66a26d3ec9632ef67d06b11366b68c8d8081d6eab6
Dridex
714400a7bc623325caa68ab943724d9b7d1e623fc8cf7546165aef0a19e46044
Dridex
88ce1108f181b31c988378dc9606d15a1582b315bc785bb61ba5283a56182379
Dridex
afa5aa95fb44edefde6e1e8ecbf28fbebf4b56c272e13bb42e49be640223e419
Dridex
cd49ec07f3bfb622b3406f2490b87fa0dc8f17770566247c410e0474c4635caf
Dridex
e84bdf9aa0e18218c7233e7e290dcd49d587e8b59c5fa214f636317ea1d00e8e
Dridex
efe83af8f6c4be824f69b3e9b77e42e974ea1abc1e311e428f7d9a5e34e4f220
Dridex
+ 4 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet loader persistence
Link:
https://tria.ge/reports/201114-3ckcz63p1s/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Control Panel
Suspicious use of SetWindowsHookEx
Enumerates connected drives
Modifies Installed Components in the registry
Dridex Loader
Dridex
Unpacked files
SH256 hash:
8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5
MD5 hash:
f05d149e9ff22e60d9e2e0f3e6626be1
SHA1 hash:
95878c9ae830da49858b4a559a60c02558e48ea4
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
SH256 hash:
f4e99b883b9bc1109ebfc6647eb62060e2cd3b5e111a2f22b23581856bbb5786
MD5 hash:
3d93096e9085beb5435d03500e57a052
SHA1 hash:
dee0ddc897cfe1d698ec95d98c12c04581ceff6c
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
SH256 hash:
f60a59ac112ef78bda9d2a6c78f259a9b4ee5d92f52a525ef9aa0c8d813e5707
MD5 hash:
d8dc8870b9460b6bda82fac6e8894dfd
SHA1 hash:
06ff963a94445af3cf6662563e30462f8dd18637
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
SH256 hash:
8863ebda2d14279959fd094e9f698f486e3b97b0524bc3c63f5ecd37eeb77249
MD5 hash:
19164b8de0357fc84460aa851de429cb
SHA1 hash:
3058dddd0109765e640992e80b7611251e7d6029
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
SH256 hash:
2118cb740766023eee92f83b9ea355c9717994b1502d515742f3ca1ecc56b5e4
MD5 hash:
9c7cda3bc19f5fa1efa714aeb24d5090
SHA1 hash:
31095816c32bd5dcdcb6f6fb57a56cb3ee3b2b07
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
SH256 hash:
ecfa7a56bb748fe3e20ed8f04f0da492532c5d37f7ef4f741cafe6194ddd86d0
MD5 hash:
2a025f058eac425b6c31c42801ce3d2b
SHA1 hash:
b04edd2e0572f14b6059463c89daa0165b24930d
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
SH256 hash:
a9207909dbafb81503b225f9337d2a09f62df1b421823a41664ee1306bbca330
MD5 hash:
a368ad3dd18f1e25e6c529ff6cc8b6e8
SHA1 hash:
b9c1bf538149e68d689af031a8f8db6060205884
Detections:
win_dridex_auto
Create hunting rule
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
Parent samples :
a8b34bd0f7f2978d29a7b2ded1a938bf3ed5a7c847904e71fd6d78428d79aa4d
df439ed7022b249d8d68c42d3a81d754857e645cf5e29e6ef44f4388b1a5acc7
2e53039cd08d3426760fc1c463026df6aaf8fe8fc9f753983bee946b9ebc619d
0ab479ba3ea986893b1d55140bc1f18b95972fa1e39838b8f47760b8b4009cf5
f6b258c964600e7b03795de450af4189103a631dd7a081e52805174fd0de5aff
11831f3b2400978816bc852ed847ecdc7d4ce922abe3d9fb1ad554376ca838f5
8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5
SH256 hash:
09f9e04e1caebd8be26ffab0f48ef64cc4036ab11ec2f7bbad272bb490b4299f
MD5 hash:
bfd06cee5f69c4c4da9279c280b9c4c6
SHA1 hash:
f7a32d10ea49a389d331bb3eb3e74c56d35437c9
Link:
https://www.unpac.me/results/7222a7b3-4a34-407f-a28b-fb8f16253779/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dridex
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8acc9a5e57fe2486bba6ba105014137d9b752894bc73262893cc522e08b3fbc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DridexV4
Create hunting rule
Author:kevoreilly
Description:Dridex v4 Payload
Rule name:win_dridex_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_dridex_loader_v2
Create hunting rule
Author:Johannes Bader @viql
Description:detects some Dridex loaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments